Statement on Personal Data Collection & Processing at LIS
(This statement has been prepared following the guidelines of GDPR)
Disclaimer
This document intends to illustrate the process of personal data collection of LIS community members using different school-based systems. As LIS treats safety and security with the highest priority, during this COVID-19 circumstance, it is important for LIS to collect and monitor the temperatures of every individual who enters the school campus. While LIS considers the information herein to be reliable, it makes no warranty or representation as to its accuracy, completeness, or correctness. The document is also intended for informational purposes only and should not be construed as legal advice for any particular facts or circumstances.
Luanda International School is not responsible for any damage or loss incurred by any of its members or any third party acting based on the contents of this document. The school reserves the right to change or amend it at any time without notice.
School’s Liability on Personal Data Protection:
LIS follows data privacy protection practices that are advised by EU GDPR and by the domestic legislation (General Data Protection Regulation and Angola Data Protection Act of 2011 “ADPA”). All systems that process personal data at LIS are GDPR and domestically compliant in terms of system security, data protection, and access.
Facing the severe public health emergency, the coronavirus pandemic, Luanda International School has prepared and implemented immediate measures in order to mitigate and lower the risks associated with COVID-19.
In the next few pages, we have highlighted the most important concerns on the legality of data processing during the implementation of measures aimed to stop the spread of coronavirus.
The school has implemented systematic measures that require managing the lowest level of printed or paper version of personal data to avoid any sort of mishandling of data.
Integrated database systems are functional in the school to store data that comes with data encryption, security levels, and minimal numbers of data processors.
Who will have access to temperature data at LIS during COVID-19 and at what level?
|
Department |
Position |
Access |
|
LIS Health Department |
Medical Officers |
Read/Write/Edit (Full Access) |
|
Technological Support |
IT Team |
Read/Write/Edit (Full Access) |
How LIS is going to collect personal data for COVID-19 precautions?
For safety & security reasons, the school has implemented several digital systems including access control, biometric security, temperature screening cameras, and digital thermometers, etc. These systems collect and store specific information in secured databases. Apart from these systems, the school has implemented digital forms that are mandatory for the submission of data in order to get access to the school campus. Therefore, by accessing the school campus the owner of the data consents to their personal and health data to be collected, processed, and stored by LIS until the circumstances that triggered the collection of said data come to an end.
Is it important to maintain the same discretion of handling personal data during a pandemic like COVID-19?
The answer is Yes. Regardless of the circumstances, LIS will strictly maintain the confidentiality of personal information.
What measures can be taken by the Data Controller (The school) with regard to people who need to enter the premises of the school (employees, parents, students, helpers, nannies, or suppliers)?
The school is working on implementing digital systems that would collect specific information on an individual’s recent activity such as recent travel information or close contact with other individuals who may or may not be in contact with COVID-19 patients. The submission of this information will be mandatory in order to enter school.
For which purpose and on which legal basis the school can process the collected personal data in the execution of the prevention measure?
Purpose: The collected information will be analyzed if a person has been diagnosed with COVID-19 as this data can be used to trace others who may or may not be related to that person or whom may have had direct or indirect contact. As the submission of the form is mandatory daily basis, the consistency of data will be part of the analytics.
Legal Standpoint: The health and safety of the community members of LIS is the responsibility of the school. The processing of health data can be based on Art 9, para - 2, list - B GDPR in conjunction with the relevant provisions on the duty of care (processing for the purpose of fulfilling obligations under labor and social law) and Art. 14 of ADPA. Data processing will be carried out in compliance with the purpose limitation principle in accordance with Art 5, para - 1 list - A GDPR and Art. 9 of ADPA. The use of health data for purposes other than health care, virus containment, and curative treatment is therefore not permitted and as a data controller, the school has implemented measures to prevent any possible data breach.
How long should the school eventually retain such data?
After the end of the pandemic, therefore, that data that will no longer be necessary (such as in particular the private contact details of employees) will be deleted.
Who to contact if there is a concern about the rightful use of personal data in LIS?
The Compliance Manager at LIS will be the first contact person for any query related to personal data processing.
LIS Compliance Manager’s contact information:
Adelino Chipaca
Phone: +24494738094
Email: achipaca@lisluanda.com